Bitcoin Cash

random

Bitcoin

Zcash

Security

<div class="sg-post-des">
  A series of attacks drained the wallets of BTC users by exploiting a faulty random seed generation algorithm. 
</div> 
<div class="cointelegraph"> 
 <p>A newly discovered vulnerability in the Libbitcoin Explorer 3.x library has allowed over $900,000 to be stolen from Bitcoin&nbsp;users, according to a report from blockchain security firm SlowMist. The vulnerability can also affect users of Ethereum, Ripple, Dogecoin, Solana, Litecoin, Bitcoin Cash and Zcash who use Libbitcoin to generate accounts.</p> 
 <blockquote class="twitter-tweet"> 
  <p lang="en" dir="ltr">SlowMist Security Alert<br><br>Recently, #Distrust <a rel="noopener noreferrer nofollow" title="discovered" href="https://thebittimes.com/tag/discovered.html">discovered</a> a severe vulnerability affecting cryptocurrency <a rel="noopener noreferrer nofollow" title="wallet" href="https://thebittimes.com/tag/wallet.html">wallet</a>s using the #Libbitcoin Explorer 3.x versions. This vulnerability allows attackers to access <a rel="noopener noreferrer nofollow" title="wallet" href="https://thebittimes.com/tag/wallet.html">wallet</a> private keys by exploiting the Mersenne Twister pseudo-random…</p>— SlowMist (@SlowMist_Team) August 10, 2023 
 </blockquote> 
 <p>Libbitcoin is a Bitcoin wallet implementation that developers and validators sometimes use to create Bitcoin (BTC)&nbsp;and other cryptocurrency accounts. According to its official website, it is used by “Airbitz (mobile wallet), Bitprim (developer interface), Blockchain Commons (decentralized wallet identity), Cancoin (decentralized exchange)” and other applications. SlowMist did not specify which applications that use Libbitcoin, if any, are affected by the vulnerability.</p> 
 <p>Cointelegraph reached out to the Libbitcoin Institute through email but had not received a comment at the time of publication.</p> 
 <p>SlowMist identified cybersecurity team “Distrust" as the team that originally discovered the loophole, which is called the “Milk Sad” vulnerability. It was reported to the CEV cybersecurity vulnerability database on Aug. 7.</p> 
 <p>According to the post, the Libbitcoin Explorer has a faulty key generation mechanism, allowing private keys to be guessed by attackers. As a result, attackers exploited this vulnerability to steal over $900,000 worth of crypto as of Aug. 10.</p> 
 <p>SlowMist emphasized that one attack in particular siphoned away over 9.7441 BTC (approximately $278,318). The firm claims to have “blocked” the address, implying that the team has contacted exchanges to prevent the attacker from cashing out the funds. The team also stated that it will be monitoring the address in case funds are moved elsewhere.</p> 
 <p>Four members of the Distrust team, along with eight freelance security consultants who claim to have helped discover the vulnerability, have set up an informational website explaining the vulnerability. They explained that the loophole is created when users employ the “bx seed” command to generate a wallet seed. This command “uses the Mersenne Twister pseudorandom number generator (PRNG) initialized with 32 bits of system time,” which lacks sufficient randomness and therefore sometimes produces the same seed for multiple persons.</p> 
 <figure> 
  <img src="https://cdn.thebittimes.com/images/2023/08/11/50483582368e4ea6f3ccc680aef0be38.webp" alt="" title=""> 
  <figcaption style="text-align: center;"> <em>Bx seed command producing the same seed twice. Source: Milk Sad information site</em> 
  </figcaption> 
 </figure> 
 <p>The researchers claim to have <a rel="noopener noreferrer nofollow" title="discovered" href="https://thebittimes.com/tag/discovered.html">discovered</a> the vulnerability when they were contacted by a Libbitcoin user whose BTC had mysteriously gone missing on July 21. When the user reached out to other Libbitcoin users to try to determine how the BTC could have gone missing, the person found that other users were also having their BTC siphoned away.</p> 
 <p>Wallet vulnerabilities continue to pose a problem for crypto users in 2023. Over $100 million was lost in a hack of the Atomic Wallet in June, which was acknowledged by the app’s team on June 22. Cybersecurity certification platform CER released its <a rel="noopener noreferrer nofollow" title="wallet" href="https://thebittimes.com/tag/wallet.html">wallet</a> security rankings in July, noting that only six out of 45 <a rel="noopener noreferrer nofollow" title="wallet" href="https://thebittimes.com/tag/wallet.html">wallet</a> brands employ penetration testing to <a rel="noopener noreferrer nofollow" title="discover" href="https://thebittimes.com/tag/discover.html">discover</a> vulnerabilities.</p> 
 <template data-name="subscription_form" data-type="markets_outlook"></template> 
</div>

Newly discovered Bitcoin wallet loophole let hackers steal $900K — SlowMist

TheBitTimes

Other articles published on Aug 10, 2023

According to Decentralized Exchange Aveo, This Altcoin To Be Listed On Binance Will Be Among The ...

Shiba Memu Announces BitMart Listing As Presale Soars Past $1.5M Milestone

JUST IN: Upbit Lists a New Altcoin! Price Spikes Suddenly

PEPE’s social metrics rise while price goes red

SEC appeals court’s Ripple ruling, says “wrongly decided”

TWT‘s Bullish Momentum Builds as Buyers Defend Support

Join our free newsletter for daily crypto updates!